@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/internal/crypto/projectionHistory.js

@@ -0,0 +1,90 @@
+import { bytesToHex } from "./hex.js";
+import { createIncrementalSha256 } from "./incrementalSha256.js";
+import { projectionHistoryArrays, } from "./projectionHistorySlots.js";
+function historyDigest(key, values) {
+    const hash = createIncrementalSha256();
+    hash.update(new TextEncoder().encode(JSON.stringify(["tearleads.projection-history", key, values])));
+    return bytesToHex(hash.digest());
+}
+/** Byte commitments describe evidence, not an authorization or verification result. */
+export function captureProjectionHistory(projection) {
+    return projectionHistoryArrays(projection).flatMap((array) => array.chains.flatMap((chain) => {
+        if (chain.values.length === 0)
+            return [];
+        const values = structuredClone(chain.values);
+        return [
+            {
+                arrayKey: array.key,
+                values,
+                prefix: {
+                    key: chain.key,
+                    count: values.length,
+                    digest: historyDigest(chain.key, values),
+                },
+            },
+        ];
+    }));
+}
+/** Call only after normal server authorization and stored-evidence verification. */
+export function omitProjectionHistory(projection, hints) {
+    if (hints.length === 0)
+        return projection;
+    // Server loaders may share arrays and objects between paths. JSON wire
+    // locations are independent: trimming one must not change another slot.
+    const result = JSON.parse(JSON.stringify(projection));
+    const requested = new Map(hints.map((hint) => [hint.key, hint]));
+    const omitted = [];
+    for (const array of projectionHistoryArrays(result)) {
+        const removed = new Map();
+        for (const chain of array.chains) {
+            const hint = requested.get(chain.key);
+            if (!hint || hint.count > chain.values.length)
+                continue;
+            const prefix = chain.values.slice(0, hint.count);
+            if (historyDigest(chain.key, prefix) !== hint.digest)
+                continue;
+            for (const item of prefix)
+                removed.set(item, (removed.get(item) ?? 0) + 1);
+            omitted.push(hint);
+        }
+        const retained = array.values.filter((value) => {
+            const remaining = removed.get(value) ?? 0;
+            if (remaining === 0)
+                return true;
+            removed.set(value, remaining - 1);
+            return false;
+        });
+        array.values.length = 0;
+        for (const value of retained)
+            array.values.push(value);
+    }
+    if (omitted.length)
+        result.historyPrefixes = omitted;
+    return result;
+}
+/** Rebuild exact cached evidence before the caller performs all ordinary checks. */
+export function restoreProjectionHistory(projection, requested) {
+    const arrays = new Map(projectionHistoryArrays(projection).map((array) => [array.key, array]));
+    const available = new Map(requested.map((entry) => [entry.prefix.key, entry]));
+    for (const prefix of projection.historyPrefixes ?? []) {
+        const entry = available.get(prefix.key);
+        if (!entry ||
+            entry.prefix.count !== prefix.count ||
+            entry.prefix.digest !== prefix.digest)
+            return false;
+        const target = arrays.get(entry.arrayKey);
+        if (!target || historyDigest(prefix.key, entry.values) !== prefix.digest)
+            return false;
+        const suffix = target.values.slice();
+        target.values.length = 0;
+        for (const value of structuredClone(entry.values))
+            target.values.push(value);
+        for (const value of suffix)
+            target.values.push(value);
+        target.restoreOrder?.();
+        available.delete(prefix.key);
+    }
+    delete projection.historyPrefixes;
+    return true;
+}
+//# sourceMappingURL=projectionHistory.js.map

package/internal/crypto/projectionHistory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectionHistory.js","sourceRoot":"","sources":["projectionHistory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAEL,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AASlC,SAAS,aAAa,CAAC,GAAW,EAAE,MAA0B;IAC5D,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM,CACT,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,IAAI,CAAC,SAAS,CAAC,CAAC,8BAA8B,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAC9D,CACF,CAAC;IACF,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,wBAAwB,CACtC,UAA6B;IAE7B,OAAO,uBAAuB,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3D,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7B,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,OAAO;YACL;gBACE,QAAQ,EAAE,KAAK,CAAC,GAAG;gBACnB,MAAM;gBACN,MAAM,EAAE;oBACN,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC;iBACzC;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,qBAAqB,CACnC,UAAa,EACb,KAAyC;IAEzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAC1C,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,MAAM,GAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM;gBAAE,SAAS;YACxD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM;gBAAE,SAAS;YAC/D,KAAK,MAAM,IAAI,IAAI,MAAM;gBACvB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,SAAS,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,QAAQ;YAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,eAAe,GAAG,OAAO,CAAC;IACrD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,wBAAwB,CACtC,UAA6B,EAC7B,SAA+C;IAE/C,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,uBAAuB,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CACvE,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CACpD,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,IACE,CAAC,KAAK;YACN,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;YACnC,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAErC,OAAO,KAAK,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM;YACtE,OAAO,KAAK,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;YAC/C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;QACxB,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,UAAU,CAAC,eAAe,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import type { ProjectionHistoryPrefix } from \"@tearleads/validators/util\";\nimport { bytesToHex } from \"./hex\";\nimport { createIncrementalSha256 } from \"./incrementalSha256\";\nimport {\n  type HistoryProjection,\n  projectionHistoryArrays,\n} from \"./projectionHistorySlots\";\n\nexport type { HistoryProjection } from \"./projectionHistorySlots\";\nexport interface RetainedProjectionHistory {\n  readonly prefix: ProjectionHistoryPrefix;\n  readonly arrayKey: string;\n  readonly values: readonly unknown[];\n}\n\nfunction historyDigest(key: string, values: readonly unknown[]): string {\n  const hash = createIncrementalSha256();\n  hash.update(\n    new TextEncoder().encode(\n      JSON.stringify([\"tearleads.projection-history\", key, values]),\n    ),\n  );\n  return bytesToHex(hash.digest());\n}\n\n/** Byte commitments describe evidence, not an authorization or verification result. */\nexport function captureProjectionHistory(\n  projection: HistoryProjection,\n): RetainedProjectionHistory[] {\n  return projectionHistoryArrays(projection).flatMap((array) =>\n    array.chains.flatMap((chain) => {\n      if (chain.values.length === 0) return [];\n      const values = structuredClone(chain.values);\n      return [\n        {\n          arrayKey: array.key,\n          values,\n          prefix: {\n            key: chain.key,\n            count: values.length,\n            digest: historyDigest(chain.key, values),\n          },\n        },\n      ];\n    }),\n  );\n}\n\n/** Call only after normal server authorization and stored-evidence verification. */\nexport function omitProjectionHistory<T extends HistoryProjection>(\n  projection: T,\n  hints: readonly ProjectionHistoryPrefix[],\n): T {\n  if (hints.length === 0) return projection;\n  // Server loaders may share arrays and objects between paths. JSON wire\n  // locations are independent: trimming one must not change another slot.\n  const result: T = JSON.parse(JSON.stringify(projection));\n  const requested = new Map(hints.map((hint) => [hint.key, hint]));\n  const omitted: ProjectionHistoryPrefix[] = [];\n  for (const array of projectionHistoryArrays(result)) {\n    const removed = new Map<unknown, number>();\n    for (const chain of array.chains) {\n      const hint = requested.get(chain.key);\n      if (!hint || hint.count > chain.values.length) continue;\n      const prefix = chain.values.slice(0, hint.count);\n      if (historyDigest(chain.key, prefix) !== hint.digest) continue;\n      for (const item of prefix)\n        removed.set(item, (removed.get(item) ?? 0) + 1);\n      omitted.push(hint);\n    }\n    const retained = array.values.filter((value) => {\n      const remaining = removed.get(value) ?? 0;\n      if (remaining === 0) return true;\n      removed.set(value, remaining - 1);\n      return false;\n    });\n    array.values.length = 0;\n    for (const value of retained) array.values.push(value);\n  }\n  if (omitted.length) result.historyPrefixes = omitted;\n  return result;\n}\n\n/** Rebuild exact cached evidence before the caller performs all ordinary checks. */\nexport function restoreProjectionHistory(\n  projection: HistoryProjection,\n  requested: readonly RetainedProjectionHistory[],\n): boolean {\n  const arrays = new Map(\n    projectionHistoryArrays(projection).map((array) => [array.key, array]),\n  );\n  const available = new Map(\n    requested.map((entry) => [entry.prefix.key, entry]),\n  );\n  for (const prefix of projection.historyPrefixes ?? []) {\n    const entry = available.get(prefix.key);\n    if (\n      !entry ||\n      entry.prefix.count !== prefix.count ||\n      entry.prefix.digest !== prefix.digest\n    )\n      return false;\n    const target = arrays.get(entry.arrayKey);\n    if (!target || historyDigest(prefix.key, entry.values) !== prefix.digest)\n      return false;\n    const suffix = target.values.slice();\n    target.values.length = 0;\n    for (const value of structuredClone(entry.values))\n      target.values.push(value);\n    for (const value of suffix) target.values.push(value);\n    target.restoreOrder?.();\n    available.delete(prefix.key);\n  }\n  delete projection.historyPrefixes;\n  return true;\n}\n"]}

package/internal/crypto/projectionHistorySlots.d.ts

@@ -0,0 +1,13 @@
+import type { ContainerWriterProjectionResponse, DocumentWriterProjectionResponse } from "../validators/response/index.js";
+export type HistoryProjection = ContainerWriterProjectionResponse | DocumentWriterProjectionResponse;
+export interface ProjectionHistoryArray {
+    readonly key: string;
+    readonly values: unknown[];
+    readonly restoreOrder?: (() => void) | undefined;
+    readonly chains: readonly {
+        readonly key: string;
+        readonly values: unknown[];
+    }[];
+}
+/** Only these evidence arrays can be omitted. Current heads and keys always travel. */
+export declare function projectionHistoryArrays(projection: HistoryProjection): ProjectionHistoryArray[];

package/internal/crypto/projectionHistorySlots.js

@@ -0,0 +1,85 @@
+import { compareCanonicalStrings } from "./canonicalOrdering.js";
+function manifestEpoch(bundle) {
+    const epoch = Reflect.get(bundle.manifest, "epoch");
+    return typeof epoch === "number" && Number.isFinite(epoch) ? epoch : 0;
+}
+function isDocumentProjection(projection) {
+    return "documentId" in projection && "documentManifest" in projection;
+}
+function unambiguousArrays(arrays) {
+    const occurrences = new Map();
+    for (const array of arrays)
+        occurrences.set(array.key, (occurrences.get(array.key) ?? 0) + 1);
+    // Ambiguous locations cannot safely negotiate an omission. Deliver them full.
+    return arrays.filter((array) => occurrences.get(array.key) === 1);
+}
+function manifestHistoryArray(key, values, newestFirst) {
+    const groups = new Map();
+    for (const value of values) {
+        const chain = JSON.stringify([
+            key,
+            Reflect.get(value.manifest, "organizationId"),
+            Reflect.get(value.manifest, "objectKind"),
+            Reflect.get(value.manifest, "objectId"),
+        ]);
+        const entries = groups.get(chain) ?? [];
+        entries.push(value);
+        groups.set(chain, entries);
+    }
+    return {
+        key,
+        values,
+        restoreOrder: newestFirst
+            ? () => {
+                values.sort((a, b) => manifestEpoch(b) - manifestEpoch(a));
+            }
+            : undefined,
+        chains: [...groups].map(([chain, entries]) => ({
+            key: chain,
+            values: entries.sort((a, b) => manifestEpoch(a) - manifestEpoch(b) ||
+                compareCanonicalStrings(a.manifestHash, b.manifestHash)),
+        })),
+    };
+}
+/** Only these evidence arrays can be omitted. Current heads and keys always travel. */
+export function projectionHistoryArrays(projection) {
+    const arrays = [];
+    const identity = isDocumentProjection(projection)
+        ? [
+            "document",
+            Reflect.get(projection.documentManifest.manifest, "organizationId"),
+            projection.documentId,
+        ]
+        : ["container", projection.organizationId, projection.containerId];
+    const add = (name, values) => {
+        const key = JSON.stringify([...identity, name]);
+        arrays.push({ key, values, chains: [{ key, values }] });
+    };
+    const manifests = (name, values, newestFirst = false) => {
+        const key = JSON.stringify([...identity, name]);
+        arrays.push(manifestHistoryArray(key, values, newestFirst));
+    };
+    const path = (name, value) => {
+        for (const [index, kek] of value.containerKeks.entries())
+            manifests(`${name}:kek:${index}:${kek.containerId}`, kek.containerManifestHistory);
+    };
+    const evidence = projection.policyEvidence;
+    if (evidence.organization)
+        add(`organization:${evidence.organization.currentState.principalId}`, evidence.organization.previousStates);
+    for (const group of evidence.groups)
+        add(`group:${group.currentState.principalId}`, group.previousStates);
+    add("organizationPayloads", evidence.organizationPayloads);
+    if (!isDocumentProjection(projection))
+        path("container", projection);
+    else {
+        for (const [index, value] of projection.authorizingContainerPaths.entries())
+            path(`path:${index}:${value.containerId}`, value);
+        // A dependency path is ordered root-to-leaf, not an unordered history.
+        for (const [index, values,] of projection.documentManifestContainerPaths.entries())
+            add(`documentManifestContainerPaths:${index}`, values);
+        manifests("documentContainerManifestHistory", projection.documentContainerManifestHistory);
+        manifests("documentManifestHistory", projection.documentManifestHistory, true);
+    }
+    return unambiguousArrays(arrays);
+}
+//# sourceMappingURL=projectionHistorySlots.js.map

package/internal/crypto/projectionHistorySlots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectionHistorySlots.js","sourceRoot":"","sources":["projectionHistorySlots.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAe9D,SAAS,aAAa,CAAC,MAAwC;IAC7D,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,oBAAoB,CAC3B,UAA6B;IAE7B,OAAO,YAAY,IAAI,UAAU,IAAI,kBAAkB,IAAI,UAAU,CAAC;AACxE,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAgC;IAEhC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM;QACxB,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,8EAA8E;IAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAW,EACX,MAA0C,EAC1C,WAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8C,CAAC;IACrE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;YAC3B,GAAG;YACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO;QACL,GAAG;QACH,MAAM;QACN,YAAY,EAAE,WAAW;YACvB,CAAC,CAAC,GAAG,EAAE;gBACH,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,CAAC;YACH,CAAC,CAAC,SAAS;QACb,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7C,GAAG,EAAE,KAAK;YACV,MAAM,EAAE,OAAO,CAAC,IAAI,CAClB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;gBACnC,uBAAuB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,CAC1D;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,uBAAuB,CACrC,UAA6B;IAE7B,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC;QAC/C,CAAC,CAAC;YACE,UAAU;YACV,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,CAAC;YACnE,UAAU,CAAC,UAAU;SACtB;QACH,CAAC,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,MAAiB,EAAE,EAAE;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAChB,IAAY,EACZ,MAA0C,EAC1C,WAAW,GAAG,KAAK,EACnB,EAAE;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,KAAkC,EAAE,EAAE;QAChE,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE;YACtD,SAAS,CACP,GAAG,IAAI,QAAQ,KAAK,IAAI,GAAG,CAAC,WAAW,EAAE,EACzC,GAAG,CAAC,wBAAwB,CAC7B,CAAC;IACN,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,UAAU,CAAC,cAAc,CAAC;IAC3C,IAAI,QAAQ,CAAC,YAAY;QACvB,GAAG,CACD,gBAAgB,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,WAAW,EAAE,EAChE,QAAQ,CAAC,YAAY,CAAC,cAAc,CACrC,CAAC;IACJ,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM;QACjC,GAAG,CAAC,SAAS,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACvE,GAAG,CAAC,sBAAsB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC3D,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;SAChE,CAAC;QACJ,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,UAAU,CAAC,yBAAyB,CAAC,OAAO,EAAE;YACzE,IAAI,CAAC,QAAQ,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;QACpD,uEAAuE;QACvE,KAAK,MAAM,CACT,KAAK,EACL,MAAM,EACP,IAAI,UAAU,CAAC,8BAA8B,CAAC,OAAO,EAAE;YACtD,GAAG,CAAC,kCAAkC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QACzD,SAAS,CACP,kCAAkC,EAClC,UAAU,CAAC,gCAAgC,CAC5C,CAAC;QACF,SAAS,CACP,yBAAyB,EACzB,UAAU,CAAC,uBAAuB,EAClC,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import type {\n  AccessManifestBundleWireResponse,\n  ContainerKeyingPathResponse,\n  ContainerWriterProjectionResponse,\n  DocumentWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { compareCanonicalStrings } from \"./canonicalOrdering\";\n\nexport type HistoryProjection =\n  | ContainerWriterProjectionResponse\n  | DocumentWriterProjectionResponse;\nexport interface ProjectionHistoryArray {\n  readonly key: string;\n  readonly values: unknown[];\n  readonly restoreOrder?: (() => void) | undefined;\n  readonly chains: readonly {\n    readonly key: string;\n    readonly values: unknown[];\n  }[];\n}\n\nfunction manifestEpoch(bundle: AccessManifestBundleWireResponse): number {\n  const epoch: unknown = Reflect.get(bundle.manifest, \"epoch\");\n  return typeof epoch === \"number\" && Number.isFinite(epoch) ? epoch : 0;\n}\n\nfunction isDocumentProjection(\n  projection: HistoryProjection,\n): projection is DocumentWriterProjectionResponse {\n  return \"documentId\" in projection && \"documentManifest\" in projection;\n}\n\nfunction unambiguousArrays(\n  arrays: ProjectionHistoryArray[],\n): ProjectionHistoryArray[] {\n  const occurrences = new Map<string, number>();\n  for (const array of arrays)\n    occurrences.set(array.key, (occurrences.get(array.key) ?? 0) + 1);\n  // Ambiguous locations cannot safely negotiate an omission. Deliver them full.\n  return arrays.filter((array) => occurrences.get(array.key) === 1);\n}\n\nfunction manifestHistoryArray(\n  key: string,\n  values: AccessManifestBundleWireResponse[],\n  newestFirst: boolean,\n): ProjectionHistoryArray {\n  const groups = new Map<string, AccessManifestBundleWireResponse[]>();\n  for (const value of values) {\n    const chain = JSON.stringify([\n      key,\n      Reflect.get(value.manifest, \"organizationId\"),\n      Reflect.get(value.manifest, \"objectKind\"),\n      Reflect.get(value.manifest, \"objectId\"),\n    ]);\n    const entries = groups.get(chain) ?? [];\n    entries.push(value);\n    groups.set(chain, entries);\n  }\n  return {\n    key,\n    values,\n    restoreOrder: newestFirst\n      ? () => {\n          values.sort((a, b) => manifestEpoch(b) - manifestEpoch(a));\n        }\n      : undefined,\n    chains: [...groups].map(([chain, entries]) => ({\n      key: chain,\n      values: entries.sort(\n        (a, b) =>\n          manifestEpoch(a) - manifestEpoch(b) ||\n          compareCanonicalStrings(a.manifestHash, b.manifestHash),\n      ),\n    })),\n  };\n}\n\n/** Only these evidence arrays can be omitted. Current heads and keys always travel. */\nexport function projectionHistoryArrays(\n  projection: HistoryProjection,\n): ProjectionHistoryArray[] {\n  const arrays: ProjectionHistoryArray[] = [];\n  const identity = isDocumentProjection(projection)\n    ? [\n        \"document\",\n        Reflect.get(projection.documentManifest.manifest, \"organizationId\"),\n        projection.documentId,\n      ]\n    : [\"container\", projection.organizationId, projection.containerId];\n  const add = (name: string, values: unknown[]) => {\n    const key = JSON.stringify([...identity, name]);\n    arrays.push({ key, values, chains: [{ key, values }] });\n  };\n  const manifests = (\n    name: string,\n    values: AccessManifestBundleWireResponse[],\n    newestFirst = false,\n  ) => {\n    const key = JSON.stringify([...identity, name]);\n    arrays.push(manifestHistoryArray(key, values, newestFirst));\n  };\n  const path = (name: string, value: ContainerKeyingPathResponse) => {\n    for (const [index, kek] of value.containerKeks.entries())\n      manifests(\n        `${name}:kek:${index}:${kek.containerId}`,\n        kek.containerManifestHistory,\n      );\n  };\n  const evidence = projection.policyEvidence;\n  if (evidence.organization)\n    add(\n      `organization:${evidence.organization.currentState.principalId}`,\n      evidence.organization.previousStates,\n    );\n  for (const group of evidence.groups)\n    add(`group:${group.currentState.principalId}`, group.previousStates);\n  add(\"organizationPayloads\", evidence.organizationPayloads);\n  if (!isDocumentProjection(projection)) path(\"container\", projection);\n  else {\n    for (const [index, value] of projection.authorizingContainerPaths.entries())\n      path(`path:${index}:${value.containerId}`, value);\n    // A dependency path is ordered root-to-leaf, not an unordered history.\n    for (const [\n      index,\n      values,\n    ] of projection.documentManifestContainerPaths.entries())\n      add(`documentManifestContainerPaths:${index}`, values);\n    manifests(\n      \"documentContainerManifestHistory\",\n      projection.documentContainerManifestHistory,\n    );\n    manifests(\n      \"documentManifestHistory\",\n      projection.documentManifestHistory,\n      true,\n    );\n  }\n  return unambiguousArrays(arrays);\n}\n"]}

package/internal/crypto/signing/generateKeyPair.d.ts

@@ -0,0 +1,9 @@
+export interface SigningKeyPair {
+    readonly signingPublicKey: Uint8Array;
+    readonly signingPrivateKey: Uint8Array;
+}
+export declare const ML_DSA87_PUBLIC_KEY_BYTES = 2592;
+export declare const ML_DSA87_SECRET_KEY_BYTES = 4896;
+export declare const ML_DSA87_SIGNATURE_BYTES = 4627;
+export declare function generateSigningKeyPair(seed: Uint8Array): SigningKeyPair;
+export declare function generateSigningSeedAndKeyPair(): SigningKeyPair;

package/internal/crypto/signing/generateKeyPair.js

@@ -0,0 +1,17 @@
+import { ml_dsa87 } from "@noble/post-quantum/ml-dsa.js";
+import { randomBytes } from "@noble/post-quantum/utils.js";
+export const ML_DSA87_PUBLIC_KEY_BYTES = 2592;
+export const ML_DSA87_SECRET_KEY_BYTES = 4896;
+export const ML_DSA87_SIGNATURE_BYTES = 4627;
+// ML-DSA-87 provides Level 5 security of NIST's Post-Quantum Cryptography standardization (FIPS 204).
+export function generateSigningKeyPair(seed) {
+    if (seed.length !== 32) {
+        throw new Error("ML-DSA-87 signing seed must be 32 bytes");
+    }
+    const { publicKey, secretKey } = ml_dsa87.keygen(seed);
+    return { signingPublicKey: publicKey, signingPrivateKey: secretKey };
+}
+export function generateSigningSeedAndKeyPair() {
+    return generateSigningKeyPair(randomBytes(32));
+}
+//# sourceMappingURL=generateKeyPair.js.map

package/internal/crypto/signing/generateKeyPair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generateKeyPair.js","sourceRoot":"","sources":["generateKeyPair.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAO3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAC9C,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAC9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,sGAAsG;AACtG,MAAM,UAAU,sBAAsB,CAAC,IAAgB;IACrD,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,6BAA6B;IAC3C,OAAO,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC","sourcesContent":["import { ml_dsa87 } from \"@noble/post-quantum/ml-dsa.js\";\nimport { randomBytes } from \"@noble/post-quantum/utils.js\";\n\nexport interface SigningKeyPair {\n  readonly signingPublicKey: Uint8Array;\n  readonly signingPrivateKey: Uint8Array;\n}\n\nexport const ML_DSA87_PUBLIC_KEY_BYTES = 2592;\nexport const ML_DSA87_SECRET_KEY_BYTES = 4896;\nexport const ML_DSA87_SIGNATURE_BYTES = 4627;\n\n// ML-DSA-87 provides Level 5 security of NIST's Post-Quantum Cryptography standardization (FIPS 204).\nexport function generateSigningKeyPair(seed: Uint8Array): SigningKeyPair {\n  if (seed.length !== 32) {\n    throw new Error(\"ML-DSA-87 signing seed must be 32 bytes\");\n  }\n\n  const { publicKey, secretKey } = ml_dsa87.keygen(seed);\n  return { signingPublicKey: publicKey, signingPrivateKey: secretKey };\n}\n\nexport function generateSigningSeedAndKeyPair(): SigningKeyPair {\n  return generateSigningKeyPair(randomBytes(32));\n}\n"]}

package/internal/crypto/signing/sign.d.ts

@@ -0,0 +1 @@
+export declare function sign(message: Uint8Array, secretKey: Uint8Array): Uint8Array;

package/internal/crypto/signing/sign.js

@@ -0,0 +1,9 @@
+import { ml_dsa87 } from "@noble/post-quantum/ml-dsa.js";
+import { ML_DSA87_SECRET_KEY_BYTES } from "./generateKeyPair.js";
+export function sign(message, secretKey) {
+    if (secretKey.length !== ML_DSA87_SECRET_KEY_BYTES) {
+        throw new Error("ML-DSA-87 signing requires a 4896-byte secret key");
+    }
+    return ml_dsa87.sign(message, secretKey);
+}
+//# sourceMappingURL=sign.js.map

package/internal/crypto/signing/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["sign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,MAAM,UAAU,IAAI,CAAC,OAAmB,EAAE,SAAqB;IAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC","sourcesContent":["import { ml_dsa87 } from \"@noble/post-quantum/ml-dsa.js\";\nimport { ML_DSA87_SECRET_KEY_BYTES } from \"./generateKeyPair\";\n\nexport function sign(message: Uint8Array, secretKey: Uint8Array): Uint8Array {\n  if (secretKey.length !== ML_DSA87_SECRET_KEY_BYTES) {\n    throw new Error(\"ML-DSA-87 signing requires a 4896-byte secret key\");\n  }\n\n  return ml_dsa87.sign(message, secretKey);\n}\n"]}

package/internal/crypto/signing/verifiedHistorySignature.js

@@ -0,0 +1,37 @@
+import { bytesToHex } from "../hex.js";
+import { createIncrementalSha256 } from "../incrementalSha256.js";
+import { verify } from "./verify.js";
+export function signatureVerificationDigest(signature, message, publicKey) {
+    const hash = createIncrementalSha256();
+    for (const bytes of [signature, message, publicKey]) {
+        const length = new Uint8Array(8);
+        new DataView(length.buffer).setBigUint64(0, BigInt(bytes.byteLength));
+        hash.update(length);
+        hash.update(bytes);
+    }
+    return hash.digest();
+}
+/** Only signature mathematics is memoized. Authorization and checkpoints always run. */
+export function createHistorySignatureVerifier(verifySignature = verify, capacity = 8192) {
+    const accepted = new Set();
+    const check = (signature, message, publicKey) => {
+        const key = bytesToHex(signatureVerificationDigest(signature, message, publicKey));
+        if (accepted.delete(key)) {
+            accepted.add(key);
+            return true;
+        }
+        if (!verifySignature(signature, message, publicKey))
+            return false;
+        accepted.add(key);
+        while (accepted.size > capacity) {
+            const oldest = accepted.values().next().value;
+            if (oldest === undefined)
+                break;
+            accepted.delete(oldest);
+        }
+        return true;
+    };
+    return Object.assign(check, { clear: () => accepted.clear() });
+}
+export const verifyHistorySignature = createHistorySignatureVerifier();
+//# sourceMappingURL=verifiedHistorySignature.js.map

package/internal/crypto/signing/verifiedHistorySignature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedHistorySignature.js","sourceRoot":"","sources":["verifiedHistorySignature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,MAAM,UAAU,2BAA2B,CACzC,SAAqB,EACrB,OAAmB,EACnB,SAAqB;IAErB,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,8BAA8B,CAC5C,eAAe,GAAG,MAAM,EACxB,QAAQ,GAAG,IAAI;IAEf,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,KAAK,GAAG,CACZ,SAAqB,EACrB,OAAmB,EACnB,SAAqB,EACZ,EAAE;QACX,MAAM,GAAG,GAAG,UAAU,CACpB,2BAA2B,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAC3D,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,QAAQ,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,8BAA8B,EAAE,CAAC","sourcesContent":["import { bytesToHex } from \"../hex\";\nimport { createIncrementalSha256 } from \"../incrementalSha256\";\nimport { verify } from \"./verify\";\n\nexport function signatureVerificationDigest(\n  signature: Uint8Array,\n  message: Uint8Array,\n  publicKey: Uint8Array,\n): Uint8Array {\n  const hash = createIncrementalSha256();\n  for (const bytes of [signature, message, publicKey]) {\n    const length = new Uint8Array(8);\n    new DataView(length.buffer).setBigUint64(0, BigInt(bytes.byteLength));\n    hash.update(length);\n    hash.update(bytes);\n  }\n  return hash.digest();\n}\n\n/** Only signature mathematics is memoized. Authorization and checkpoints always run. */\nexport function createHistorySignatureVerifier(\n  verifySignature = verify,\n  capacity = 8192,\n) {\n  const accepted = new Set<string>();\n  const check = (\n    signature: Uint8Array,\n    message: Uint8Array,\n    publicKey: Uint8Array,\n  ): boolean => {\n    const key = bytesToHex(\n      signatureVerificationDigest(signature, message, publicKey),\n    );\n    if (accepted.delete(key)) {\n      accepted.add(key);\n      return true;\n    }\n    if (!verifySignature(signature, message, publicKey)) return false;\n    accepted.add(key);\n    while (accepted.size > capacity) {\n      const oldest = accepted.values().next().value;\n      if (oldest === undefined) break;\n      accepted.delete(oldest);\n    }\n    return true;\n  };\n  return Object.assign(check, { clear: () => accepted.clear() });\n}\n\nexport const verifyHistorySignature = createHistorySignatureVerifier();\n"]}

package/internal/crypto/signing/verifiedSignatureHistory.js

@@ -0,0 +1,60 @@
+import { bytesToHex } from "../hex.js";
+import { createIncrementalSha256 } from "../incrementalSha256.js";
+import { signatureVerificationDigest, verifyHistorySignature, } from "./verifiedHistorySignature.js";
+const DOMAIN = new TextEncoder().encode("tearleads.signature-history.v1");
+function remember(accepted, key, capacity) {
+    accepted.delete(key);
+    accepted.add(key);
+    while (accepted.size > capacity) {
+        const oldest = accepted.values().next().value;
+        if (oldest === undefined)
+            break;
+        accepted.delete(oldest);
+    }
+}
+/**
+ * Retain only digests of locally verified signature transcripts. Re-hash every
+ * supplied byte before reusing a prefix; no authorization or server head is
+ * cached. This avoids LRU scan thrashing when one history exceeds the per-entry
+ * signature cache. The two passes retain only one digest per input, not proofs.
+ */
+export function createSignatureHistoryVerifier(verifySignature = verifyHistorySignature, capacity = 128) {
+    const accepted = new Set();
+    const check = async (entries) => {
+        const digests = [];
+        let prefix = DOMAIN;
+        let verifiedThrough = 0;
+        for await (const entry of entries()) {
+            const digest = signatureVerificationDigest(entry.signature, entry.message, entry.publicKey);
+            digests.push(bytesToHex(digest));
+            const hash = createIncrementalSha256();
+            hash.update(prefix);
+            hash.update(digest);
+            prefix = hash.digest();
+            const key = bytesToHex(prefix);
+            if (accepted.delete(key)) {
+                accepted.add(key);
+                verifiedThrough = digests.length;
+            }
+        }
+        let index = 0;
+        for await (const entry of entries()) {
+            // A provider changing its input between passes must never make a cached
+            // prefix cover different bytes, nor add/remove an unchecked signature.
+            if (digests[index] !==
+                bytesToHex(signatureVerificationDigest(entry.signature, entry.message, entry.publicKey)))
+                return false;
+            if (index >= verifiedThrough &&
+                !verifySignature(entry.signature, entry.message, entry.publicKey))
+                return false;
+            index += 1;
+        }
+        if (index !== digests.length)
+            return false;
+        const key = bytesToHex(prefix);
+        remember(accepted, key, capacity);
+        return true;
+    };
+    return Object.assign(check, { clear: () => accepted.clear() });
+}
+//# sourceMappingURL=verifiedSignatureHistory.js.map

package/internal/crypto/signing/verifiedSignatureHistory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifiedSignatureHistory.js","sourceRoot":"","sources":["verifiedSignatureHistory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AAQpC,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC;AAE1E,SAAS,QAAQ,CAAC,QAAqB,EAAE,GAAW,EAAE,QAAgB;IACpE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClB,OAAO,QAAQ,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,kBAEe,sBAAsB,EACrC,QAAQ,GAAG,GAAG;IAEd,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,EACjB,OAA4C,EAC1B,EAAE;QACpB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,MAAM,GAAG,MAAM,CAAC;QACpB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,2BAA2B,CACxC,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS,CAChB,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,uBAAuB,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAClB,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;YACnC,CAAC;QACH,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,EAAE,CAAC;YACpC,wEAAwE;YACxE,uEAAuE;YACvE,IACE,OAAO,CAAC,KAAK,CAAC;gBACd,UAAU,CACR,2BAA2B,CACzB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS,CAChB,CACF;gBAED,OAAO,KAAK,CAAC;YACf,IACE,KAAK,IAAI,eAAe;gBACxB,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC;gBAEjE,OAAO,KAAK,CAAC;YACf,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/B,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC","sourcesContent":["import { bytesToHex } from \"../hex\";\nimport { createIncrementalSha256 } from \"../incrementalSha256\";\nimport {\n  signatureVerificationDigest,\n  verifyHistorySignature,\n} from \"./verifiedHistorySignature\";\n\ninterface SignatureInput {\n  readonly signature: Uint8Array;\n  readonly message: Uint8Array;\n  readonly publicKey: Uint8Array;\n}\n\nconst DOMAIN = new TextEncoder().encode(\"tearleads.signature-history.v1\");\n\nfunction remember(accepted: Set<string>, key: string, capacity: number): void {\n  accepted.delete(key);\n  accepted.add(key);\n  while (accepted.size > capacity) {\n    const oldest = accepted.values().next().value;\n    if (oldest === undefined) break;\n    accepted.delete(oldest);\n  }\n}\n\n/**\n * Retain only digests of locally verified signature transcripts. Re-hash every\n * supplied byte before reusing a prefix; no authorization or server head is\n * cached. This avoids LRU scan thrashing when one history exceeds the per-entry\n * signature cache. The two passes retain only one digest per input, not proofs.\n */\nexport function createSignatureHistoryVerifier(\n  verifySignature: (\n    ...args: Parameters<typeof verifyHistorySignature>\n  ) => boolean = verifyHistorySignature,\n  capacity = 128,\n) {\n  const accepted = new Set<string>();\n  const check = async (\n    entries: () => AsyncIterable<SignatureInput>,\n  ): Promise<boolean> => {\n    const digests: string[] = [];\n    let prefix = DOMAIN;\n    let verifiedThrough = 0;\n    for await (const entry of entries()) {\n      const digest = signatureVerificationDigest(\n        entry.signature,\n        entry.message,\n        entry.publicKey,\n      );\n      digests.push(bytesToHex(digest));\n      const hash = createIncrementalSha256();\n      hash.update(prefix);\n      hash.update(digest);\n      prefix = hash.digest();\n      const key = bytesToHex(prefix);\n      if (accepted.delete(key)) {\n        accepted.add(key);\n        verifiedThrough = digests.length;\n      }\n    }\n    let index = 0;\n    for await (const entry of entries()) {\n      // A provider changing its input between passes must never make a cached\n      // prefix cover different bytes, nor add/remove an unchecked signature.\n      if (\n        digests[index] !==\n        bytesToHex(\n          signatureVerificationDigest(\n            entry.signature,\n            entry.message,\n            entry.publicKey,\n          ),\n        )\n      )\n        return false;\n      if (\n        index >= verifiedThrough &&\n        !verifySignature(entry.signature, entry.message, entry.publicKey)\n      )\n        return false;\n      index += 1;\n    }\n    if (index !== digests.length) return false;\n    const key = bytesToHex(prefix);\n    remember(accepted, key, capacity);\n    return true;\n  };\n  return Object.assign(check, { clear: () => accepted.clear() });\n}\n"]}

package/internal/crypto/signing/verify.d.ts

@@ -0,0 +1 @@
+export declare function verify(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): boolean;

package/internal/crypto/signing/verify.js

@@ -0,0 +1,16 @@
+import { ml_dsa87 } from "@noble/post-quantum/ml-dsa.js";
+import { ML_DSA87_PUBLIC_KEY_BYTES, ML_DSA87_SIGNATURE_BYTES, } from "./generateKeyPair.js";
+// Verifies an ML-DSA-87 signature against the original message bytes.
+export function verify(signature, message, publicKey) {
+    if (signature.length !== ML_DSA87_SIGNATURE_BYTES ||
+        publicKey.length !== ML_DSA87_PUBLIC_KEY_BYTES) {
+        return false;
+    }
+    try {
+        return ml_dsa87.verify(signature, message, publicKey);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=verify.js.map

package/internal/crypto/signing/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,sEAAsE;AACtE,MAAM,UAAU,MAAM,CACpB,SAAqB,EACrB,OAAmB,EACnB,SAAqB;IAErB,IACE,SAAS,CAAC,MAAM,KAAK,wBAAwB;QAC7C,SAAS,CAAC,MAAM,KAAK,yBAAyB,EAC9C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import { ml_dsa87 } from \"@noble/post-quantum/ml-dsa.js\";\nimport {\n  ML_DSA87_PUBLIC_KEY_BYTES,\n  ML_DSA87_SIGNATURE_BYTES,\n} from \"./generateKeyPair\";\n\n// Verifies an ML-DSA-87 signature against the original message bytes.\nexport function verify(\n  signature: Uint8Array,\n  message: Uint8Array,\n  publicKey: Uint8Array,\n): boolean {\n  if (\n    signature.length !== ML_DSA87_SIGNATURE_BYTES ||\n    publicKey.length !== ML_DSA87_PUBLIC_KEY_BYTES\n  ) {\n    return false;\n  }\n\n  try {\n    return ml_dsa87.verify(signature, message, publicKey);\n  } catch {\n    return false;\n  }\n}\n"]}

package/internal/crypto/symmetric.d.ts

@@ -0,0 +1,11 @@
+export interface SymmetricCiphertext {
+    iv: Uint8Array;
+    ciphertext: Uint8Array;
+}
+export declare const AES_256_KEY_BYTES = 32;
+export declare const AES_GCM_IV_BYTES = 12;
+export declare const AES_GCM_TAG_BYTES = 16;
+export declare function createAesGcmIv(): Uint8Array<ArrayBuffer>;
+export declare function assertAesGcmIv(iv: Uint8Array, message?: string): void;
+export declare function encryptWithDek(plaintext: Uint8Array, dek: Uint8Array, additionalData?: Uint8Array): Promise<SymmetricCiphertext>;
+export declare function decryptWithDek(encrypted: SymmetricCiphertext, dek: Uint8Array, additionalData?: Uint8Array): Promise<Uint8Array>;

package/internal/crypto/symmetric.js

@@ -0,0 +1,54 @@
+export const AES_256_KEY_BYTES = 32;
+export const AES_GCM_IV_BYTES = 12;
+export const AES_GCM_TAG_BYTES = 16;
+export function createAesGcmIv() {
+    return crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));
+}
+export function assertAesGcmIv(iv, message = "AES-GCM IV must be 12 bytes") {
+    if (iv.length !== AES_GCM_IV_BYTES) {
+        throw new Error(message);
+    }
+}
+function assertAes256Key(keyBytes) {
+    if (keyBytes.length !== AES_256_KEY_BYTES) {
+        throw new Error("AES-256-GCM requires a 32-byte key");
+    }
+}
+function assertAesGcmCiphertext(encrypted) {
+    assertAesGcmIv(encrypted.iv);
+    if (encrypted.ciphertext.length < AES_GCM_TAG_BYTES) {
+        throw new Error("AES-GCM ciphertext is too short");
+    }
+}
+async function importSymmetricKey(keyBytes, usage) {
+    assertAes256Key(keyBytes);
+    return crypto.subtle.importKey("raw", keyBytes.slice(), "AES-GCM", false, [
+        usage,
+    ]);
+}
+export async function encryptWithDek(plaintext, dek, additionalData) {
+    const iv = createAesGcmIv();
+    const key = await importSymmetricKey(dek, "encrypt");
+    return {
+        iv,
+        ciphertext: new Uint8Array(await crypto.subtle.encrypt({
+            name: "AES-GCM",
+            iv,
+            ...(additionalData === undefined
+                ? {}
+                : { additionalData: additionalData.slice() }),
+        }, key, plaintext.slice())),
+    };
+}
+export async function decryptWithDek(encrypted, dek, additionalData) {
+    assertAesGcmCiphertext(encrypted);
+    const key = await importSymmetricKey(dek, "decrypt");
+    return new Uint8Array(await crypto.subtle.decrypt({
+        name: "AES-GCM",
+        iv: encrypted.iv.slice(),
+        ...(additionalData === undefined
+            ? {}
+            : { additionalData: additionalData.slice() }),
+    }, key, encrypted.ciphertext.slice()));
+}
+//# sourceMappingURL=symmetric.js.map

package/internal/crypto/symmetric.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"symmetric.js","sourceRoot":"","sources":["symmetric.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,UAAU,cAAc;IAC5B,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,EAAc,EACd,OAAO,GAAG,6BAA6B;IAEvC,IAAI,EAAE,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,QAAoB;IAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,SAA8B;IAC5D,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,QAAoB,EACpB,KAA4B;IAE5B,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;QACxE,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAqB,EACrB,GAAe,EACf,cAA2B;IAE3B,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAErD,OAAO;QACL,EAAE;QACF,UAAU,EAAE,IAAI,UAAU,CACxB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;YACE,IAAI,EAAE,SAAS;YACf,EAAE;YACF,GAAG,CAAC,cAAc,KAAK,SAAS;gBAC9B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC;SAChD,EACD,GAAG,EACH,SAAS,CAAC,KAAK,EAAE,CAClB,CACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAA8B,EAC9B,GAAe,EACf,cAA2B;IAE3B,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAErD,OAAO,IAAI,UAAU,CACnB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;QACE,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE;QACxB,GAAG,CAAC,cAAc,KAAK,SAAS;YAC9B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC;KAChD,EACD,GAAG,EACH,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,CAC7B,CACF,CAAC;AACJ,CAAC","sourcesContent":["export interface SymmetricCiphertext {\n  iv: Uint8Array;\n  ciphertext: Uint8Array;\n}\n\nexport const AES_256_KEY_BYTES = 32;\nexport const AES_GCM_IV_BYTES = 12;\nexport const AES_GCM_TAG_BYTES = 16;\n\nexport function createAesGcmIv(): Uint8Array<ArrayBuffer> {\n  return crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));\n}\n\nexport function assertAesGcmIv(\n  iv: Uint8Array,\n  message = \"AES-GCM IV must be 12 bytes\",\n): void {\n  if (iv.length !== AES_GCM_IV_BYTES) {\n    throw new Error(message);\n  }\n}\n\nfunction assertAes256Key(keyBytes: Uint8Array): void {\n  if (keyBytes.length !== AES_256_KEY_BYTES) {\n    throw new Error(\"AES-256-GCM requires a 32-byte key\");\n  }\n}\n\nfunction assertAesGcmCiphertext(encrypted: SymmetricCiphertext): void {\n  assertAesGcmIv(encrypted.iv);\n  if (encrypted.ciphertext.length < AES_GCM_TAG_BYTES) {\n    throw new Error(\"AES-GCM ciphertext is too short\");\n  }\n}\n\nasync function importSymmetricKey(\n  keyBytes: Uint8Array,\n  usage: \"encrypt\" | \"decrypt\",\n): Promise<CryptoKey> {\n  assertAes256Key(keyBytes);\n  return crypto.subtle.importKey(\"raw\", keyBytes.slice(), \"AES-GCM\", false, [\n    usage,\n  ]);\n}\n\nexport async function encryptWithDek(\n  plaintext: Uint8Array,\n  dek: Uint8Array,\n  additionalData?: Uint8Array,\n): Promise<SymmetricCiphertext> {\n  const iv = createAesGcmIv();\n  const key = await importSymmetricKey(dek, \"encrypt\");\n\n  return {\n    iv,\n    ciphertext: new Uint8Array(\n      await crypto.subtle.encrypt(\n        {\n          name: \"AES-GCM\",\n          iv,\n          ...(additionalData === undefined\n            ? {}\n            : { additionalData: additionalData.slice() }),\n        },\n        key,\n        plaintext.slice(),\n      ),\n    ),\n  };\n}\n\nexport async function decryptWithDek(\n  encrypted: SymmetricCiphertext,\n  dek: Uint8Array,\n  additionalData?: Uint8Array,\n): Promise<Uint8Array> {\n  assertAesGcmCiphertext(encrypted);\n  const key = await importSymmetricKey(dek, \"decrypt\");\n\n  return new Uint8Array(\n    await crypto.subtle.decrypt(\n      {\n        name: \"AES-GCM\",\n        iv: encrypted.iv.slice(),\n        ...(additionalData === undefined\n          ? {}\n          : { additionalData: additionalData.slice() }),\n      },\n      key,\n      encrypted.ciphertext.slice(),\n    ),\n  );\n}\n"]}

package/internal/encoding/base64.js

@@ -0,0 +1,16 @@
+export function bytesToBase64(bytes) {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary);
+}
+export function base64ToBytes(value) {
+    const binary = atob(value);
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1) {
+        bytes[index] = binary.charCodeAt(index);
+    }
+    return bytes;
+}
+//# sourceMappingURL=base64.js.map

package/internal/encoding/base64.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.js","sourceRoot":"","sources":["base64.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["export function bytesToBase64(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n\n  return btoa(binary);\n}\n\nexport function base64ToBytes(value: string): Uint8Array {\n  const binary = atob(value);\n  const bytes = new Uint8Array(binary.length);\n\n  for (let index = 0; index < binary.length; index += 1) {\n    bytes[index] = binary.charCodeAt(index);\n  }\n\n  return bytes;\n}\n"]}

package/internal/encoding/index.js

@@ -0,0 +1,2 @@
+export { base64ToBytes, bytesToBase64 } from "./base64.js";
+//# sourceMappingURL=index.js.map

package/internal/encoding/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC","sourcesContent":["export { base64ToBytes, bytesToBase64 } from \"./base64\";\n"]}